PT-2026-63337 · Red Hat · Red Hat Ansible Automation Platform 2

CVE-2026-16544 · Publicado 2026-07-22 · Atualizado 2026-07-22

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer access() function (job events, workflow events, ad hoc command events). Three event groups - inventory update events, project update events, and system job events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-16544

Produtos afetados

Red Hat Ansible Automation Platform 2

Referências · 3

• https://access.redhat.com/security/cve/CVE-2026-16544 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2506053 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-16544 · Nota de Segurança